Vulnerability Spotlight: Vulnerabilities in popular Japanese word processing software could lead to arbitrary code execution, other issues
Summary: Cisco Talos discovered four vulnerabilities in Ichitaro, JustSystems' word processing software that is Japan's second most popular behind Microsoft Word, that can let an attacker execute arbitrary code when a target opens a malicious file. Two involve memory corruption from use-after-free (CVE-2022-43664) and buffer overflow (CVE-2023-22660), and two more (CVE-2023-22291 and CVE-2022-45115) are memory corruption flaws that could also lead to code execution, with a fix now available for Ichitaro 2022 version 1.0.1.57600.
Why it matters: The exploit path is a single document open, and Talos confirmed version 1.0.1.57600 of Ichitaro 2022 could be exploited, so any unpatched install in a Japanese-language environment is exposed to code execution from a file attachment.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-43664CVE-2022-45115CVE-2023-22291CVE-2023-22660
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026